<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Stephanie Sullivan wrote:
<blockquote cite="mid:05d001cbf7aa$66ebedf0$34c3c9d0$@com" type="cite">
<blockquote type="cite">
<pre wrap="">-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:blueonyx-bounces@blueonyx.it">blueonyx-bounces@blueonyx.it</a> [<a class="moz-txt-link-freetext" href="mailto:blueonyx">mailto:blueonyx</a>-
<a class="moz-txt-link-abbreviated" href="mailto:bounces@blueonyx.it">bounces@blueonyx.it</a>] On Behalf Of Gerald Waugh
Sent: Sunday, April 10, 2011 1:43 PM
To: BlueOnyx General Mailing List
Cc: <a class="moz-txt-link-abbreviated" href="mailto:ma@ciic.com">ma@ciic.com</a>
Subject: [BlueOnyx:06968] Re: Failed Open SSH yum update
On Sun, 2011-04-10 at 12:27 -0400, Stephanie Sullivan wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">From: <a class="moz-txt-link-abbreviated" href="mailto:blueonyx-bounces@blueonyx.it">blueonyx-bounces@blueonyx.it</a> [<a class="moz-txt-link-freetext" href="mailto:blueonyx">mailto:blueonyx</a>-
</pre>
</blockquote>
</blockquote>
<pre wrap=""><a class="moz-txt-link-abbreviated" href="mailto:bounces@blueonyx.it">bounces@blueonyx.it</a>]
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">On Behalf Of Michael Aronoff
Sent: Sunday, April 10, 2011 11:48 AM
To: 'BlueOnyx General Mailing List'
Subject: [BlueOnyx:06964] Failed Open SSH yum update
</pre>
</blockquote>
<pre wrap="">OK, so lost in the mess with the Apache update that was causing
</pre>
</blockquote>
<pre wrap="">problems I
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">noticed that an update to OpenSSH from the CentOS base repo is
</pre>
</blockquote>
</blockquote>
<pre wrap="">failing on
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">my BO machines. I get the following during yum update:
Running Transaction
Updating : openssh-server
67/224
Error unpacking rpm package openssh-server-4.3p2-72.el5.i386
error: unpacking of archive failed on file /usr/sbin/sshd: cpio:
</pre>
</blockquote>
</blockquote>
<pre wrap="">rename
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap=""> Updating : openssh-clients
68/224
Error unpacking rpm package openssh-clients-4.3p2-72.el5.i386
error: unpacking of archive failed on file /usr/bin/ssh: cpio:
</pre>
</blockquote>
</blockquote>
<pre wrap="">rename
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Failed:
openssh-clients.i386 0:4.3p2-72.el5
openssh-server.i386 0:4.3p2-72.el5
Anyone have any ideas?
M Aronoff Out
</pre>
</blockquote>
<pre wrap="">I have an idea - please to a:
lsattr /usr/sbin/sshd /usr/bin/ssh
If you get permissions other than a series of "-" characters you've
</pre>
</blockquote>
<pre wrap="">been hacked. Look for a file in your /lib directory with usernames
and passwords used for ssh'ing into your VPS.
</pre>
<blockquote type="cite">
<pre wrap="">Hope this isn't the case.
</pre>
</blockquote>
<pre wrap="">there maybe a file
/lib/initr
that will have ssh connected users and passwords
--
Gerald Waugh
Front Street Networks
<a class="moz-txt-link-freetext" href="http://www.frontstreetnetworks.com">http://www.frontstreetnetworks.com</a>
+1 318-670-8312
cell 318-401-0428
</pre>
</blockquote>
<pre wrap=""><!---->
Gerald,
Have you figured out how they got in? My log review showed servers hit with
attempts at the proftpd exploit that was patched in late 2010. I think that
is unlikely as a vector of entry, but I came up with nothing else. Given
that several folks servers have been compromised by this I'm interested in
knowing the how and any effective defense short of pulling the power. :-)
Thanks for remembering the name of the file in /lib which I could not
recall.
-Stephanie
</pre>
</blockquote>
Hi,<br>
<br>
Many of our vps customers seem to have joined this club, I've got the
same problems running the yum upgrade and I have changed ext attributes
on those machines. Do you have additional info about how to get rid of
the intruders, also I would be very interested to work out the vector
they got in in the first place. For the moment I was about to reinstall
openssh rpms , is that a way ?<br>
<br>
Thanks in advance for any hints,<br>
Christoph<br>
<br>
</body>
</html>